[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ruby (source)	uses-with	patch	4.0.2 → 4.0.7

---

Release Notes

ruby/ruby (ruby)

v4.0.7: 4.0.7

Compare Source

What's Changed

• Bug #​22188: addr2line doesn't find symbols when compiled with GCC LTO - Ruby - Ruby Issue Tracking System
• Bug #​22210: Check if issue #​19969 is still reproducible / re-opened in 4.0.x - Ruby - Ruby Issue Tracking System
• Bug #​22217: Segmentation fault when resuming execution with Coverage.start and ruby/debug - Ruby - Ruby Issue Tracking System
• Fix formatting in ObjectSpace._id2ref error path by eregon · Pull Request #​18206
• Bug #​22200: ObjectSpace._id2ref can return a different object than the id's owner on Ruby 4.0 (stale id2ref_tbl entry for objects with generic fields) - Ruby - Ruby Issue Tracking System
• Bug #​22123: Ruby::Box + BUNDLER_SETUP can evaluate gemspecs before main-box RubyGems initialization - Ruby - Ruby Issue Tracking System
• Bump ERB to 6.0.7 by k0kubun · Pull Request #​18282
• Bug #​22237: GC.auto_compact corrupts a String or segfaults from String#tr with dup or gsub - Ruby - Ruby Issue Tracking System
• Bug #​22243: Change fork behavior when Process._fork raises an exception during fork with a block argument - Ruby - Ruby Issue Tracking System
• Bug #​22223: Socket.tcp with connect_timeout returns a phantom "connected" socket for a refused connection on macOS 27 (kernel answers EISCONN on connect retry; SO_ERROR never consulted) - Ruby - Ruby Issue Tracking System
• Bug #​22220: Performance regression when requiring aws-sdk-ec2 in Ruby 4.0.6 - Ruby - Ruby Issue Tracking System
• Bug #​22218: Line TracePoint misses executed loop condition after a guard - Ruby - Ruby Issue Tracking System
• Bug #​22198: win32: heap overflow in Kernel#system - Ruby - Ruby Issue Tracking System
• Bug #​22196: Heap-use-after-free in fiber_switch with transfer-terminated async tasks on 3.4.10 - Ruby - Ruby Issue Tracking System
• Bug #​22190: Class#subclasses does not include clones of classes that include modules - Ruby - Ruby Issue Tracking System
• Bug #​11438: native_thread_init_stack() get machine.stack_start unequal to thread's stack start address, x86 win32 - Ruby - Ruby Issue Tracking System
• Bug #​22257: Prepending a module to an already-included module leaves stale super caches - Ruby - Ruby Issue Tracking System
• Bug #​22242: SEGV in method dispatch (vm_call_iseq_setup_kwparm_nokwarg / def_iseq_ptr) on Ruby 4.0.6 — Rails CI - Ruby - Ruby Issue Tracking System
• Bug #​22269: Coverage.line_stub clobbers already-collected coverage data - Ruby - Ruby Issue Tracking System
• Bug #​22290: Adding instance variables to anonymous object may bloat all future classes - Ruby - Ruby Issue Tracking System
• Bug #​22292: YJIT/ZJIT: Struct accessor crashes after an instance variable is set on a Struct that exactly fills the largest GC slot - Ruby - Ruby Issue Tracking System
• Bug #​20958: fix ENV.keys encoding on windows - Ruby - Ruby Issue Tracking System
• Bug #​22259: Arrays sharding a buffer segfault when concatenating with each other - Ruby - Ruby Issue Tracking System
• Bug #​22264: Warning missing from parse.y hash literals - Ruby - Ruby Issue Tracking System
• Bug #​22303: EncodingError from interpolating symbol crashes whole process - Ruby - Ruby Issue Tracking System
• Bug #​22224: YJIT: rb_yjit_invalidate_ep_is_bp takes the VM lock stopping Ractors on every Proc materialization; multi-Ractor throughput collapses (up to ~150x) - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.6: 4.0.6

Compare Source

What's Changed

• Bug #​22070: Thread.each_caller_location(1, 1) segfaults when called from a cfunc - Ruby - Ruby Issue Tracking System
• Bug #​22075: heap-use-after-free in rb_vm_ci_lookup under parallel Ractors - Ruby - Ruby Issue Tracking System
• Bug #​22076: defined? returns nil for protected methods defined in a module even when callable - Ruby - Ruby Issue Tracking System
• Bug #​22072: [BUG] should have cvar cache entry - Ruby - Ruby Issue Tracking System
• Bug #​22074: YJIT misaligns locals when there are > 256 local variables - Ruby - Ruby Issue Tracking System
• Bug #​22064: GC compaction breaks compare-by-identity sets - Ruby - Ruby Issue Tracking System
• Bug #​22084: invokesuper from define_method in Ractor can call wrong super method or crash - Ruby - Ruby Issue Tracking System
• Bug #​22092: Array#sum takes slow path, does not perform compensated summation of Float elements when init argument is a Float - Ruby - Ruby Issue Tracking System
• Bug #​14635: Float#round(n) returns a wrong result when n is big - Ruby - Ruby Issue Tracking System
• Bug #​22079: Float#ceil gives incorrect result - Ruby - Ruby Issue Tracking System
• Bug #​22096: Freeing a mutex locked by a fiber inside fiber scheduler can crash - Ruby - Ruby Issue Tracking System
• Bug #​21996: Crash when modifying instance variables during inspect or Marshal dump - Ruby - Ruby Issue Tracking System
• Bug #​22101: ASAN heap-use-after-free in rb_data_free after TypedData dfree frees dynamic rb_data_type_t - Ruby - Ruby Issue Tracking System
• Bug #​22103: Constant-folded /o regexp crashes with dupstring of a Regexp - Ruby - Ruby Issue Tracking System
• Bug #​21991: $! stays as the first exception in Ruby Box - Ruby - Ruby Issue Tracking System
• Feature #​21881: Split the root box into the (newer) root box and the master of copied user boxes - Ruby - Ruby Issue Tracking System
• Bug #​22120: Segfault caused by ar_find_entry_hint() not checking for conversion to st_table - Ruby - Ruby Issue Tracking System
• Bug #​22129: error_highlight raises NotImplementedError for ArgumentErrors that get wrapped - Ruby - Ruby Issue Tracking System
• Bug #​21864: Inconsistencies in type coercion error messages for integers - Ruby - Ruby Issue Tracking System
• Bug #​21882: IO::Buffer#locked leaves the buffer locked when the block raises - Ruby - Ruby Issue Tracking System
• Bug #​22127: parse.y regexp crash on invalid encoding - Ruby - Ruby Issue Tracking System
• Bug #​22126: Stack underflow for partial DCE and loops - Ruby - Ruby Issue Tracking System
• Bug #​22124: void value missed in parse.y - Ruby - Ruby Issue Tracking System
• Bug #​22104: Segfault in PRISM while Bootsnap compiles aws-sdk client_api.rb - Ruby - Ruby Issue Tracking System
• Bug #​21685: Unnecessary context-switching, especially bad on multi-core machines. - Ruby - Ruby Issue Tracking System
• Bug #​22099: Keyword-only method silently accepts a positional argument - Ruby - Ruby Issue Tracking System
• Bug #​22183: parse.y interpolation inside lambda literal - Ruby - Ruby Issue Tracking System
• Bug #​22181: SEGV in branch peephole optimization due to label/insn struct aliasing - Ruby - Ruby Issue Tracking System
• Bug #​22133: Ruby's default SIGINT handling ignores Thread.handle_interrupt masking. - Ruby - Ruby Issue Tracking System
• Bug #​22189: Enumerator::Lazy#to_enum does not accept method names as strings - Ruby - Ruby Issue Tracking System
• Bug #​22191: Signal.trap(:EXIT) exception only shown if at_exit also raises - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.5

Compare Source

v4.0.4: 4.0.4

Compare Source

What's Changed

• Bug #​21955: Fiber#transfer: machine stack not released when fiber terminates, causing FiberError: can't set a guard page - Ruby - Ruby Issue Tracking System
• Bug #​21964: Fiber stack acquire can expand unnecessarily - Ruby - Ruby Issue Tracking System
• Bug #​21971: Fix regexp performance regression for patterns starting with s/k - Ruby - Ruby Issue Tracking System
• Bug #​21961: Marshal.load freeze option fail to freeze linked strings - Ruby - Ruby Issue Tracking System
• Bug #​21959: rb_internal_thread_event_hooks_rw_lock is not reinitialized after fork causing deadlocks - Ruby - Ruby Issue Tracking System
• Bug #​21954: NoMethodError instead of Gem::LoadError on gem activation problem in Ruby 4.0.2 - Ruby - Ruby Issue Tracking System
• Bug #​21844: Inconsistent ArgumentError message for Data::define.new - Ruby - Ruby Issue Tracking System
• Bug #​21992: Defining BasicObject#initialize causes segmentation fault - Ruby - Ruby Issue Tracking System
• Bug #​22018: ISeq created via RubyVM::InstructionSequence.compile don't support coverage - Ruby - Ruby Issue Tracking System
• Bug #​21985: RubyVM::AST negative numbers do not include - in location - Ruby - Ruby Issue Tracking System
• Bug #​21986: RubyVM::AST incorrect location for literals followed by modifier if - Ruby - Ruby Issue Tracking System
• Bug #​21933: Ruby::Box: named capture local variable can become nil after non-matching lines - Ruby - Ruby Issue Tracking System
• Bug #​21940: Ruby::Box: $_ returns stale value due to gvar_tbl caching - Ruby - Ruby Issue Tracking System
• Bug #​22004: parse.y doesn't executes loop body with while true || true condition - Ruby - Ruby Issue Tracking System
• Bug #​21952: Ruby::Box double free at process exit when fiddle/import is required in multiple boxes - Ruby - Ruby Issue Tracking System
• Bug #​22003: .bundle extensions not built when doing out-of-source build - Ruby - Ruby Issue Tracking System
• Bug #​22002: argument stack underflow (-1) - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.3: 4.0.3

Compare Source

What's Changed

• Prohibit def_method on marshal-loaded ERB instances (CVE-2026-41316)

Full Changelog

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 26b04a70-cf4d-425e-8249-d1e8eb78b186

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.